Full Report
Zbtlink security advisory (AV26-779)
Analysis Summary
# Vulnerability: Zbtlink "ENDLESSDOORS" Remote Root Implant
## CVE Details
- **CVE ID:** CVE-2024-39203 (Associated with the ENDLESSDOORS research)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-912: Managed Address Space (Backdoor) / CWE-78: OS Command Injection
## Affected Systems
- **Products:** Various Zbtlink Router Models
- **Versions:**
- CPE2801: 22.10.09
- WE1026-5G-WD: 21.04.07
- WE1326: 22.02.18_1
- WE2007: 23.08.12
- WE2008-DSIM: 23.08.11
- WE2416: 21.03.22_1
- WE3326: 20.09.30
- WE5927: 22.08.10
- WE5931 / WE5931AC: 22.05.31
- WE826-T3-DSIM: 21.12.21
- WG108: 21.08.06_1
- WG1602: 23.10.11
- WG1608-DSIM: 23.03.16
- WG209: 21.07.28
- WG2105: 22.05.30
- WG2107: 22.09.08
- WG259: 21.03.23
- WG3526: 22.11.01
- ZBT-Z8102AX-2SIM: 7.6.7.2-25.0814_114432
- **Configurations:** Default factory firmware installations.
## Vulnerability Description
The vulnerability, dubbed **ENDLESSDOORS**, involves a pre-installed "phone-home" root implant discovered in the firmware of multiple Zbtlink router models. The firmware includes a binary (often named `rctl` or masked as `kworker`) that establishes a persistent connection to a remote Command and Control (C2) server. This component allows for remote linux control, effectively acting as a backdoor that provides root-level access to the device without the user's knowledge or consent.
## Exploitation
- **Status:** PoC available / Actively documented (Functioning as an intentional backdoor).
- **Complexity:** Low (The functionality is built into the firmware).
- **Attack Vector:** Network (The device initiates outbound connections to external infrastructure).
## Impact
- **Confidentiality:** Total (Attacker can access all data passing through the router).
- **Integrity:** Total (Attacker has root access to modify system files and settings).
- **Availability:** Total (Attacker can disable the device or intercept traffic).
## Remediation
### Patches
- Users are advised to check the official Zbtlink firmware download page for updated versions that remove the `rctl` component.
- Ensure firmware versions are newer than those listed in the "Affected Systems" section.
### Workarounds
- **Network Filtering:** Implement strict outbound firewall rules to block the router from communicating with unknown or unauthorized IP addresses/domains, specifically those associated with `ycsunjane` or GitHub-hosted control repositories.
- **Third-Party Firmware:** If supported, consider flashing the device with open-source alternatives like OpenWrt (if the hardware is compatible), which does not contain the vendor's proprietary root implants.
## Detection
- **Indicators of Compromise:**
- Presence of a process named `rctl` or a suspicious `kworker` process running from `/usr/bin/` or `/tmp/` rather than the kernel.
- Outbound traffic to suspicious external management IPs or GitHub repositories (specifically hxxps[://]github[.]com/ycsunjane/rctl).
- **Detection methods and tools:**
- Monitor network logs for persistent TCP connections from the router to external hosts not initiated by the user.
- Inspect the process list via SSH (if access is available) for unauthorized binaries.
## References
- Zbtlink Advisory: [AV26-779]
- VulnCheck Advisory: hxxps[://]www[.]vulncheck[.]com/advisories/zbt-endlessdoors
- Vendor Firmware Page: hxxps[://]www[.]zbtlink[.]com/pages/zbt-router-firmware-download
- Backdoor Source Reference: hxxps[://]github[.]com/ycsunjane/rctl